IPMA News : January 2004

Edited By Mary Ellen Bradley and Andy Marcelia

Top 10 Security Practices for Senior Managers

Imaging Project Cuts Paperwork and Costs at DOL

IPMA Establishes Scholarships

News from the Past

Summary of December 11, 2003 IPMA Board Meeting

Top 10 Security Practices for Senior Managers

-- by Mary Lou Griffith, DIS

We all understand that computer security incidents are on the rise and that agencies spend considerable effort and resources to clean up after an incident and to prevent the next attacks from happening. The purpose of this article is to provide senior management with some recommended security management practices. It excerpts recommendations from Common Sense Guide for Senior Managers, Top Ten Recommended Information Security Practices produced by the Internet Security Alliance, consisting of members of Carnegie Mellon University’s Software Engineering Institute; its CERT Coordination Center; the Electronic Industries Alliance (EIA), a federation of trade associations; and public and private member corporations. This group encourages the sharing of their work because "through sharing and adopting commonly accepted, good security practices, all organizations can begin to successfully manage their security risks."

PRACTICE #1: General Management

Managers throughout the organization consider information security a normal part of their responsibility and the responsibility of every employee.

Managers clearly define and assign information security roles and responsibilities and ensure adequate resources are allocated to fulfill these.
Manager actions include visible sponsorship and direction, written communications, and staff meeting time on this subject.
Managers create, enforce, and regularly review security policy.

PRACTICE #2: Policy

Develop, deploy, review, and enforce security policies that satisfy business objectives.

Create policies that address key security topic areas such as security risk management, critical asset identification, physical security, system and network management, authentication and authorization, access control, vulnerability management, incident management, awareness and training, and privacy.
Ensure that the intent of each policy is reflected in standards, procedures, practices, training, and security architectures that implement it.

PRACTICE #3: Risk Management

Periodically conduct an information security risk evaluation that identifies critical information assets (e.g., systems, networks, data), threats to critical assets, asset vulnerabilities, and risks.

Identify the adverse impacts when risks to critical assets are realized including financial, reputation, market position, time/productivity, etc. Quantify the financial impact to the greatest extent possible.
Develop and implement a risk mitigation plan resulting from the evaluation (update as needed).
Ensure that there is regular review and management of the risks to critical information assets.

PRACTICE #4: Security Architecture & Design

Generate, implement, and maintain an enterprise- (or site-) wide security architecture, based on satisfying business objectives and protecting the most critical information assets.

Deploy a layered approach (i.e., network, host, application, data) including the practices that follow.
Use diversity and redundancy solutions (power supplies, telecommunications, hardware, operating systems, applications) for high risk/high reliance systems.

PRACTICE #5.1: User Issues: Accountability and Training

Establish accountability for user actions, train for accountability and enforce it, as reflected in organizational policies and procedures. Users include all those who have active accounts such as employees, partners, suppliers, and vendors.

All users consider information security to be a normal part of their day-to-day responsibilities.
Prior to receiving an account, users receive training in all policy topics such as password selection and protection, file access permissions, expectations of privacy, safe Web browsing, and social engineering.
Users receive training in consequences and sanctions related to policy violations including legal ramifications.

PRACTICE #5.2: User Issues: Adequate Expertise

Ensure that there is adequate in-house expertise or explicitly outsourced expertise for all supported technologies (e.g., host and network operating systems, routers, firewalls, monitoring tools, and applications software), including the secure operation of those technologies.

PRACTICE #6.1: System & Network Management: Access Control

Establish a range of security controls to protect assets residing on systems and networks.

Use access controls at network-, system-, file-, and application levels as required.
Use data encryption and virtual private network technologies as required.
Use perimeter and internal security applications (including firewalls) that implement security policy.
Use removable storage media for critical data so that it can be physically secured.
Deploy a system discard process that eradicates all data from disks and memory prior to disposal.

PRACTICE #6.2: System & Network Management: Software Integrity

Regularly verify the integrity of installed software.
Regularly check for and eradicate all viruses, worms, Trojan horses, other malicious software, and unauthorized software.
Regularly compare all file and directory cryptographic checksums with a securely stored, maintained, and trusted baseline.

PRACTICE #6.3: System & Network Management: Secure Asset Configuration

Provide procedures and mechanisms to ensure the secure configuration of all deployed assets throughout their life cycle of installation, operation, maintenance, and retirement.

Apply patches to correct security and functionality problems.
Establish and maintain a standard, minimum essential configuration for each type of computer and each type of service.
Create a network topology diagram and ensure it is kept up to date. Enable adequate levels of logging.
Consider the security implications for all changes to systems and networks.
Perform vulnerability assessments on a periodic basis, and address vulnerabilities when they are identified.

PRACTICE #6.4: System & Network Management: Backups

Mandate a regular schedule of backups for both software and data.

Validate software and data before backup.
Validate software and data after backup.
Verify the ability to restore from backups.

PRACTICE #7.1: Authentication & Authorization: Users

Implement and maintain appropriate mechanisms for user authentication and authorization when using network access from inside and outside the organization. Ensure these are consistent with policies, procedures, roles, and levels of restricted access required for specific assets.

PRACTICE #7.2: Authentication & Authorization: Remote and Third Parties

Protect critical assets when providing network access to users working remotely and to third parties such as contractors and service providers. Use network-, system-, file-, and application-level access controls and restrict access to authorized times and tasks, as required.

Use data encryption and virtual private network technologies, as required.

PRACTICE #8: Monitor & Audit

Use appropriate monitoring, auditing, and inspection facilities and assign responsibility for reporting, evaluating, and responding to system and network events and conditions.

Regularly use system and network monitoring tools and examine the results they produce.
Regularly use filtering and analysis tools and examine the results they produce.
Respond to events that warrant a response action.
Ensure that all employees are aware of whom to contact when they notice suspicious behavior.

PRACTICE #9: Physical Security

Control physical access to information assets and IT services and resources.

Use physical access controls (e.g., badges, biometrics, keys), where required.
Use password-controlled electronic locks for workstations, servers, and laptops that are enabled upon login and after specified periods of inactivity.
Control access to all critical hardware assets (e.g., routers, firewalls, servers, mail hubs).

PRACTICE #10: Continuity Planning & Disaster Recovery

Develop business continuity and disaster recovery plans for critical assets and ensure that they are periodically tested and found effective.

The full text of the document can be found at: http://www.isalliance.org/news/BestPractices.pdf

Return to Top

Imaging Project Cuts Paperwork and Costs at DOL

-- by Jim Henly and Jeff Smith, Department of Licensing (DOL)

The Washington Department of Licensing faced a tremendous challenge this last biennium; it needed to develop a cost effective system that would allow rapid access to vehicle title information. This new system would also need to allow for efficient storage of literally thousands of pages of documents that come into the agency on a daily basis.

There are more than 8,000 vehicle and vessel title transactions processed in the County Auditor, Subagent and DOL offices each day. Each transaction has approximately 5 pages of supporting documents associated with it making up 40,000 pages of work that are sent to DOL Headquarters to be sorted, examined, microfilmed and stored for retrieval.

Eight people within the Investigative Research Unit (IRU) process research requests related to title applications and supporting documents. Processing requests from law enforcement, the courts, the public, vehicle dealers and others was a manual and time consuming process. It included looking up information on computer, determining what microfilm reel the title is on, locating the microfilm and then finding the title on that particular reel of microfilm. The standard for turnaround on requests was three hours for a rush job, and two days for routine requests.

To solve the problem the Strategic Technology Services (STS) unit in information services teamed up with the Vehicle Services Division to design and implement a document imaging solution that would save the agency both time and money.

STS designed a workflow imaging solution that eliminates most of the title paper handling, provides on-line title examining, enables fast and easy access to title images and provides management with critical workflow process data.

The objective was to employ imaging technology to improve workflow, storage and retrieval of titling documentation. The imaging technology provided an opportunity to significantly improve customer service and provide a technology platform for future improvements.

The project was considered more successful than planned by the Vehicle Services division. Some of the main improvements include:

The 8,000 daily transactions can now be processed, as they are received. This eliminates the labor-intensive process of sorting them into remittance days and then waiting for missing items to be received before processing the work.
The 40,000 pages a day of work is now received and processed in one area. The work is now distributed to different floors electronically through a workflow process that saves space, reduces handling time and provides a well-organized work area.
The titles are now examined on-line and the new workflow screens provide an integrated process that allows title examining, title releasing or rejecting on one easy to use screen.
The title scanning and release process is fully automated and management tracking data is available through web-based reports. The reports provide information on scanning backlogs, title release backlogs, and identifies when processed documents can be shredded.
The title display program is distributed to other work units reducing the number of information requests processed by IRU staff.
The title images are now available on-line and can be retrieved using several different search fields. This process significantly reduces the retrieval time and improves customer service provided by call center staff, by the staff who assist the 186 vehicle licensing offices throughout the state and by the staff who process law enforcement requests.

The appropriation for the project was $690,000. The project was completed on time and within the budgeted amount. In addition, the project is expected to pay for itself through reductions in FTEs and associated cost avoidance for storing paper documents.

The public also received tremendous benefits from this project:

Improved efficiency and effectiveness of Vehicle Services division staff who answer questions from the general public (Call Center) and provide assistance to vehicle licensing offices (TREC Teams.)
Reduced costs associated with the handling and retrieving of title documents.
Provides faster turnaround of information requests from various areas including Law enforcement, the courts, the public, dealers, etc.
Improved response time for law enforcement requests.

"The technology used for this project provides an IT infrastructure that delivers fundamental value -- improved reliability, better availability, and increased scalability, said Jim Henly, manager for the project.

"Flexible agency standard tools helped match the design and deployment to our organizational and network needs," Henly said. "In addition, it helped us manage our network proactively by enforcing agency policy, automating tasks, and simplifying updates."

When combined with selected products and services from the agency’s hardware and software standards list it provided choices that helped get the greatest return on the agency’s infrastructure investments.

"The products used for this project were MS SQL 2000, NT based Security with Visual Basic and ASP programming," Henly said. "It is important to note that proprietary document management imaging software was not used in this project. This will save over $100,000 per year in on-going software license and maintenance costs. This architecture allows for a more flexible hardware and software environment."

Return to Top

IPMA Establishes Scholarships

-- by Mary Ellen Bradley, IPMA Communications Committee Co-Chair

The Information Processing Management Association recently established two scholarships. The object is to help deserving students meet their educational goals in the computer field.

The first was an $18,000 donation to establish an endowed Information Processing Management Association Scholarship in Computer Information Systems at South Puget Sound Community College (SPSCC) -- $3,000 will be used to fund a $1,000 annual scholarship for the academic years of 2004-05, 2005-06 and 2006-07 and the $15,000 balance will be directed to scholarship endowment. Beginning in year four, the college hopes that the investment income will provide annual awards in perpetuity. Every March, SPSCC distributes an annual scholarship booklet to current students and to high school students in the college’s service district. The IPMA scholarship is for students pursuing studies in the SPSCC Computer Information Systems Program with preference given to students currently working in, or planning to work in, Washington State government agencies.

The second scholarship was established at The Evergreen State College (TESC) with a $25,000 gift from the IPMA. Recipients of awards from this fund will be known as the Information Processing Management Association Scholars. Recipients of the IPMA Scholarships should demonstrate interest in Information Management and/or Computer Science, and be either current Washington State employees attending Evergreen or show an interest in working in Washington State government after graduation. TESC will provide the IPMA with the names of scholarship winners.

Return to Top

News from the Past

5 Years Ago -- January 1999 IPMA Newsletter

10 Years Ago -- January 1994 IPMA Newsletter

15 Years Ago -- January 1989 IPMA Newsletter

20 Years Ago -- January 1984 Association of Data Processing Managers Newsletter

25 Years Ago -- January 1979 Association of Data Processing Managers Newsletter

Return to Top

Summary of December 11, 2003 IPMA Board Meeting

Members Present: Jim Albert, Phil Grigg, Sheryl Hall, Dennis Jones, Dennis Laine, Andy Marcelia and Christy Ridout. Phil Coates, CFO was also present.

Christy Ridout, IPMA Vice-Chair, opened the December 2003 meeting of the IPMA Board of Directors at 7:40 a.m.

REPORTS

Secretary/Treasurer: The minutes from the November 2003 Board meeting were approved.

The Board approved the November 2003 financial status and activities reports.

Business Planning: Christy Ridout distributed the investment portfolio report received from Merrill Lynch and discussed the current status.

Forum: Dennis Laine reported that several planning committee meetings were held in the past month. He and other committee members on the board concurred that planning is proceeding on schedule. Dennis attributed this to the fact that committee membership has been stable for several years and everyone knows what has to be done and how to proceed.

Dennis submitted a draft budget for the 2004 Forum to Phil Coates.

Executive Seminar: Phil Grigg reported that he and Darrel visited the Shilo at Ocean Shores. The last time the IPMA held an Executive Seminar there the meeting room proved to be inadequate, so Phil and Darrel worked out a better solution. They have a contract ready for signature to hold the 2005 Executive Seminar at the Shilo pending approval of the board. The board approved and directed Phil to sign the contract. Phil stated that he and Darrel had also secured an option for holding the 2006 Executive Seminar at the Shilo.

Professional Development: Sheryl Hall reported that the January 22, 2004, event "Disaster Recovery / Business Continuity" is on track and ready to go.

Dennis Jones presented a proposal for the IPMA to provide its own microphones based on research done by Jim Andersen. The proposal showed that for a total of about $370 the IPMA would have two wireless microphones, one six-way mixer, and a variety of cables for connection to a facility's audio system. The board agreed that the financial commitment was minimal and the potential improvement in availability of equipment make the purchase a good decision.

Prior to purchasing the equipment, Sheryl, Dennis, and Jim Andersen need to visit Saint Martin's to review with them issues and procedures. For example, would St. Martin’s allow IPMA to use the microphones with their audio systems. Once that is resolved, the next step is to test the proposed equipment for compatibility. When those two issues are resolved, several other things need to be determined: for example, could the equipment be kept at Saint Martin's; and, if we have trouble with our equipment at an event, can we expect help from Saint Martin's? Sheryl and Dennis will report back at the next meeting and possibly seek approval to buy the equipment.

Communications: Andy Marcelia reported that the December IPMA News was released December 9. Andy will provide an article for the January issue.

OTHER BUSINESS:

Storage Space: Several issues regarding IPMA’s need for better storage space were discussed. Among them, the need for committees to be able to access the new audio equipment when they need it for an event, as well as storage for various event banners and supplies. Additionally, Phil Coates stated that the current arrangement for long term storage of IPMA contractual and financial documents is not adequate. The board directed Phil to explore rental of a small storage unit that could accommodate the IPMA needs on an ongoing basis and report back to the board at the January meeting.

Scholarship: Jim Albert had the contract from Evergreen State College that would establish an endowed scholarship in the name of the IPMA for an amount of $25,000. It had to be signed by Mike McVicker as IPMA board Chair and Phil Coates as IPMA CFO. Phil Coates is to send the signed documents and a check for $25,000 to Evergreen as soon as possible.

Board Meeting Location: The January 8th board meeting will be held at the Shipwreck Cafe.

The meeting was adjourned at 8:14 a.m.

Return to Top

IPMA, P.O. Box 1943, Olympia, WA 98507-1943